5 ms·

I just got this automatic up/down/side-grade. DNS to be handled by a partner service provider, so they get all my data instead of my ISP getting it? Doesn't s

I just got this automatic up/down/side-grade. DNS to be handled by a partner service provider, so they get all my data instead of my ISP getting it? Doesn't seem like an improvement. I think I will turn this off.

josephcsible 5y ago
> DNS to be handled by a partner service provider, so they get all my data instead of my ISP getting it? Doesn't seem like an improvement. It's an improvement in two ways. One, the DoH provider will only know that your IP address looked up certain hosts, unlike your ISP who also knows the association between your real-life identity and your IP address. Two, most ISPs (especially in the US) have horrific privacy policies and practices compared to the DoH servers.
- johnklos 5y ago
  We have a financial relationship with our ISPs. What kind of contracts and understandings do we have with Cloudflare? What do we know about them aside from the fact that they protect scammers and spammers? Sorry, but that's not an improvement at all.
  - throwaway81523 5y ago
    Is it known that the partner service provider is Cloudflare? At least that's a recognized organization, instead of a mysterious unnamed one as the Mozilla announcement made it sound. When that happens we have to assume the worst.
    - josephcsible 5y ago
      Yes, it is. You can see that in this article from the screenshot in the "Switching providers" section. They also say it explicitly here: https://support.mozilla.org/en-US/kb/dns-over-https-doh-faqs#w_what-resolver-will-firefox-be-using https://support.mozilla.org/en-US/kb/dns-over-https-doh-faqs...
  - josephcsible 5y ago
    While I disagree, I support you having the right and ability to disable DoH on your own devices anyway. I just don't want middlebox operators to be able to forcibly prevent other people from using DoH from their own computers.
    - throwaway81523 5y ago
      It is a good feature to offer to people. The way they switched it on out of nowhere was disturbing, though.
  - zamadatix 5y ago
    > What do we know about them aside from the fact that they protect scammers and spammers? We know their DNS services have very transparently stated sound privacy policies that have been regularly audited by 3rd parties to verify compliance to promises made to users as well as Mozilla and APNIC which they partnered with for this. The worst finding to date from multiple years of service was Cloudflare did not initially mention 0.05% of all network packets in their network are temporarily logged to disk via sFlow sampling to help detect/manage DDoS and that would mean some DoH packets source IPs would be stored on disks during the time not just completely in RAM. I work at a network VAR, I've never seen a DNS resolver with an equally good privacy policy that is actually backed up by 3rd party verification. I have seen endless ISPs sell user data or abuse DNS for additional income and clearly state this in the very service contracts that specify you as the paying customer. I mean it's your prerogative to dislike Cloudflare and not use them but when they have blogposts directly responding to "We knew there would be skeptics. Many consumers believe that if they aren’t paying for a product, then they are the product." https://blog.cloudflare.com/announcing-the-results-of-the-1-1-1-1-public-dns-resolver-privacy-examination/ https://blog.cloudflare.com/announcing-the-results-of-the-1-... the questions in your comment speak more to what you'd like to believe than what we actually know.
    - johnklos 5y ago
      They've actively lied to people. They intentionally deceive people. For example: Their contact information is in WHOIS for countless domains. If you send an abuse complaint to the address in WHOIS, you get a form response telling you to fill out a form on a web site, which is clumsy, slow, has tons of errors, and basically makes the whole process time consuming and arduous. The form response implies but does not state that they ignore abuse complaints unless abuse is reported in their shitty web form. I asked repeatedly for clarification. They answered with bullshit and sidespeak and WOULD NOT ANSWER DIRECTLY for months. In a nutshell: they don't want you to report abuse, and they make it hard on purpose, and they're assholes about answering simple, direct questions. Why? Because they make money from spammers and scammers. They've told me that phishing sites they host that claim to be Adobe ("Flash Updaters") or Bank of America are exercising "free speech". They just don't want to be bothered. And the whole "We don't host" bullshit: if you provide services on the Internet that contribute to stuff on the Internet working, and if you stopped providing those services, that stuff would stop working, YOU'RE HOSTING. It doesn't matter if it's just DNS, or if it's a caching proxy - you're still facilitating services on the Internet. But just listen to their absolute bullshit about how they "don't host", and you know they're shitty people. That doesn't even touch on how they're intentionally stratifying the Internet by putting CAPTCHAs on everything and blocking the poor half of the world, and how, if they had their way, they'd be a monopoly that would re-centralize and completely stratify the whole planet...
  - tptacek 5y ago
    If you're in the US, whatever you think your contracts and financial relationships say, your ISP is highly likely to be monetizing your DNS lookups already. It's hard to do worse than ISP DNS (and ISP DNS passive monitoring).
    - throwaway81523 5y ago
      You might be right, but who knows. My ISP does claim to be privacy friendly. I think of self-hosting DNS on a VM nearby anyway, or maybe multiple ones with randomization. I just haven't gotten around to it yet.
zamalek 5y ago
You could host your own DNS server and DOH to it, Firefox doesn't force you to use Cloudflare.
- josephcsible 5y ago
  That mostly defeats the purpose though, since to your ISP, a DNS packet from Firefox and a DNS packet from your local DoH server both look the same. Now if you hosted it on a VPS or something instead, then it would definitely be worthwhile.
  - 22c 5y ago
    You can setup a forwarding DNS Proxy that uses DoH eg. dnscrypt-proxy, then use traditional DNS on your machine to localhost.
    - josephcsible 5y ago
      Doesn't dnscrypt-proxy provide DoH on the wrong side of the connection?
      - dinosaurdynasty 5y ago
        No? It's does DoH from itself to the wider internet
        josephcsible 5y ago
        Ah, you're right. I got it confused with https://crates.io/crates/doh-proxy https://crates.io/crates/doh-proxy, which another user mentioned here.
autoexec 5y ago
I got the pop-over notice for the first time today as well... I'm wondering now how they did it. I have firefox set to notify me about updates, but this wasn't that. I have telemetry/Normandy/experiments/etc disabled. I hope I can find whatever I have to disable to prevent settings being remotely applied to my browser outside of updates

josephcsible 5y ago

> DNS to be handled by a partner service provider, so they get all my data instead of my ISP getting it? Doesn't seem like an improvement. It's an improvement in two ways. One, the DoH provider will only know that your IP address looked up certain hosts, unlike your ISP who also knows the association between your real-life identity and your IP address. Two, most ISPs (especially in the US) have horrific privacy policies and practices compared to the DoH servers.

johnklos 5y ago
We have a financial relationship with our ISPs. What kind of contracts and understandings do we have with Cloudflare? What do we know about them aside from the fact that they protect scammers and spammers? Sorry, but that's not an improvement at all.
- throwaway81523 5y ago
  Is it known that the partner service provider is Cloudflare? At least that's a recognized organization, instead of a mysterious unnamed one as the Mozilla announcement made it sound. When that happens we have to assume the worst.
  - josephcsible 5y ago
    Yes, it is. You can see that in this article from the screenshot in the "Switching providers" section. They also say it explicitly here: https://support.mozilla.org/en-US/kb/dns-over-https-doh-faqs#w_what-resolver-will-firefox-be-using https://support.mozilla.org/en-US/kb/dns-over-https-doh-faqs...
- josephcsible 5y ago
  While I disagree, I support you having the right and ability to disable DoH on your own devices anyway. I just don't want middlebox operators to be able to forcibly prevent other people from using DoH from their own computers.
  - throwaway81523 5y ago
    It is a good feature to offer to people. The way they switched it on out of nowhere was disturbing, though.
- zamadatix 5y ago
  > What do we know about them aside from the fact that they protect scammers and spammers? We know their DNS services have very transparently stated sound privacy policies that have been regularly audited by 3rd parties to verify compliance to promises made to users as well as Mozilla and APNIC which they partnered with for this. The worst finding to date from multiple years of service was Cloudflare did not initially mention 0.05% of all network packets in their network are temporarily logged to disk via sFlow sampling to help detect/manage DDoS and that would mean some DoH packets source IPs would be stored on disks during the time not just completely in RAM. I work at a network VAR, I've never seen a DNS resolver with an equally good privacy policy that is actually backed up by 3rd party verification. I have seen endless ISPs sell user data or abuse DNS for additional income and clearly state this in the very service contracts that specify you as the paying customer. I mean it's your prerogative to dislike Cloudflare and not use them but when they have blogposts directly responding to "We knew there would be skeptics. Many consumers believe that if they aren’t paying for a product, then they are the product." https://blog.cloudflare.com/announcing-the-results-of-the-1-1-1-1-public-dns-resolver-privacy-examination/ https://blog.cloudflare.com/announcing-the-results-of-the-1-... the questions in your comment speak more to what you'd like to believe than what we actually know.
  - johnklos 5y ago
    They've actively lied to people. They intentionally deceive people. For example: Their contact information is in WHOIS for countless domains. If you send an abuse complaint to the address in WHOIS, you get a form response telling you to fill out a form on a web site, which is clumsy, slow, has tons of errors, and basically makes the whole process time consuming and arduous. The form response implies but does not state that they ignore abuse complaints unless abuse is reported in their shitty web form. I asked repeatedly for clarification. They answered with bullshit and sidespeak and WOULD NOT ANSWER DIRECTLY for months. In a nutshell: they don't want you to report abuse, and they make it hard on purpose, and they're assholes about answering simple, direct questions. Why? Because they make money from spammers and scammers. They've told me that phishing sites they host that claim to be Adobe ("Flash Updaters") or Bank of America are exercising "free speech". They just don't want to be bothered. And the whole "We don't host" bullshit: if you provide services on the Internet that contribute to stuff on the Internet working, and if you stopped providing those services, that stuff would stop working, YOU'RE HOSTING. It doesn't matter if it's just DNS, or if it's a caching proxy - you're still facilitating services on the Internet. But just listen to their absolute bullshit about how they "don't host", and you know they're shitty people. That doesn't even touch on how they're intentionally stratifying the Internet by putting CAPTCHAs on everything and blocking the poor half of the world, and how, if they had their way, they'd be a monopoly that would re-centralize and completely stratify the whole planet...
- tptacek 5y ago
  If you're in the US, whatever you think your contracts and financial relationships say, your ISP is highly likely to be monetizing your DNS lookups already. It's hard to do worse than ISP DNS (and ISP DNS passive monitoring).
  - throwaway81523 5y ago
    You might be right, but who knows. My ISP does claim to be privacy friendly. I think of self-hosting DNS on a VM nearby anyway, or maybe multiple ones with randomization. I just haven't gotten around to it yet.

zamalek 5y ago

You could host your own DNS server and DOH to it, Firefox doesn't force you to use Cloudflare.

josephcsible 5y ago
That mostly defeats the purpose though, since to your ISP, a DNS packet from Firefox and a DNS packet from your local DoH server both look the same. Now if you hosted it on a VPS or something instead, then it would definitely be worthwhile.
- 22c 5y ago
  You can setup a forwarding DNS Proxy that uses DoH eg. dnscrypt-proxy, then use traditional DNS on your machine to localhost.
  - josephcsible 5y ago
    Doesn't dnscrypt-proxy provide DoH on the wrong side of the connection?
    - dinosaurdynasty 5y ago
      No? It's does DoH from itself to the wider internet
      - josephcsible 5y ago
        Ah, you're right. I got it confused with https://crates.io/crates/doh-proxy https://crates.io/crates/doh-proxy, which another user mentioned here.

autoexec 5y ago

I got the pop-over notice for the first time today as well... I'm wondering now how they did it. I have firefox set to notify me about updates, but this wasn't that. I have telemetry/Normandy/experiments/etc disabled. I hope I can find whatever I have to disable to prevent settings being remotely applied to my browser outside of updates